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Abstract 


Fixation  upon  WMD  terrorism,  reinforced  by  the  recurring  need  to  manage  the 
consequences  of  other  manmade  or  natural  disasters,  has  conditioned  the  homeland 
security  community  to  focus  upon  prevention  and  consequence  management,  with  scant 
attention  paid  to  resolving  an  ongoing  terrorist  incident  of  a  paramilitary  nature.  The 
seizure  of  national  assets  by  an  armed  paramilitary  group  is  a  possibility  that  should  not 
be  ignored.  Terrorist  seizure  of  either  a  soft  target,  like  Russia’s  Beslan  No.  1  school  in 
2004,  or  a  hard  target  such  as  nuclear  materials  or  facilities,  could  have  enonnous 
strategic  consequences.  It  would  demand  swift,  decisive  response  probably  beyond  the 
capability  of  local  agencies.  Domestic  counterterrorist  capabilities  are  poorly  postured 
for  response  to  such  an  incident.  Standing,  regionally  based,  swiftly  responding  Federal 
forces  with  a  streamlined  command  and  control  structure  are  needed,  along  with  a 
reorientation  of  homeland  security  guidance,  training  and  exercises  to  include  response  to 
threats  of  this  nature. 
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INTRODUCTION 


Scenario:  At  0830  on  an  otherwise  normal  autumn  morning,  a  wave  of  violence 
erupts  at  locations  across  the  American  heartland,  targeted  upon  schools  and 
schoolchildren.  Improvised  explosives  detonate  in  sidewalk  trash  bins;  school  buses  are 
bombed;  lone  snipers  target  campuses  and  first  responders  in  hit  and  run  attacks.  As 
confusion  and  panic  spread  from  local  venues  to  the  national  consciousness  via  the  24- 
hour  news  media,  thirty  or  more  armed  terrorists  take  over  an  elementary  school  in  a 
small  Midwestern  city.  City  and  county  SWAT  officers  respond  to  the  scene  before  the 
scope  of  the  event  is  clear;  trained  to  respond  to  a  Columbine-like  active  shooter  incident, 
they  stage  a  hasty  assault  which  is  bloodily  repulsed. 

Executing  a  score  of  adult  hostages  as  evidence  of  their  resolve,  the  terrorists 
then  herd  hundreds  of  schoolchildren  and  staff  into  the  school  gymnasium,  which  they 
prepare  with  explosives.  They  upload  video  and  still  photographs  of  their  action  onto  the 
Internet.  Postings  identify  the  perpetrators  as  al  Qa  Ida  jihadists.  Intelligence  from  the 
police  perimeter  indicates  a  large  number  of  fighters,  with  military  small  arms, 
explosives,  and  heavy  weapons,  rapidly  improving  their  defenses. 

The  terrorists  announce  their  intention  to  execute  their  hostages  and  their 
willingness  to  accept  ‘ martyrdom  ’  in  the  event  of  another  assault,  or  if  the  U.S. 
government  does  not  take  immediate  steps  to  meet  their  single,  non-negotiable  demand: 
withdrawal  of  all  American  forces  from  Iraq,  Afghanistan,  Saudi  Arabia,  and  the  rest  of 
the  House  of  Islam. 

This  fictional  scenario  is  based  loosely  on  the  2004  takeover  by  Chechen 
separatists  of  a  school  in  Beslan,  in  the  Russian  republic  of  North  Ossetia,  where  over  a 
thousand  hostages  were  taken,  and  hundreds  of  schoolchildren  and  other  innocents  were 
ultimately  killed.1  At  the  time  of  this  writing,  heightened  concerns  over  the  possibility  of 
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a  similar  attack  in  the  United  States  have  received  public  and  media  attention. 

The  scenario  illustrates  the  threat  of  an  attack  on  the  U.S.  homeland  by  multiple 
anned  terrorists  using  conventional  weapons,  explosives,  and  tactics,  and  technical 
expertise  less  challenging  than  the  piloting  skills  that  guided  commercial  jets  into 
American  buildings  on  September  11,  2001.  The  adversary  remains  active  after  the 
moment  of  attack  initiation,  in  firm  physical  control  of  high  value  assets,  exploiting  them 
for  propaganda  value,  and  threatening  worse  consequences  to  come. 


Related  scenarios  are  not  difficult  to  construct,  using  similar  means  of  attack 
against  a  range  of  soft  targets  of  great  iconic,  political,  or  economic  value.  Attacks  on 
hardened  or  well-protected  targets  such  as  nuclear  power  plants,  nuclear  materials 
shipments,  or  seats  of  government  are  generally  considered  less  likely,  although  reports 

3 

of  surveillance  and  other  sources  suggest  a  continuing  terrorist  interest. 

From  the  standpoint  of  preparedness  and  response  planning,  such  scenarios  bear 
little  resemblance  to  the  Weapon  of  Mass  Destruction  (WMD)  scenarios  that  command 
so  much  of  our  national  attention.4  Assaults  by  anned  groups,  employing  improvised 
explosive  devices  (IED)  as  enablers  or  force  multipliers  rather  than  primary  mechanisms 
of  attack,  are  commonplace  tactics  of  terrorists  and  insurgents  worldwide.  By  contrast, 
effective  WMD  attacks,  no  matter  how  theoretically  attractive  to  terrorists,  and  how 
extreme  their  potential  consequences,  remain  so  far  the  stuff  of  fiction.  While  the  first 
order  effects  (casualties  and  physical  damage)  of  paramilitary  attacks  may  not  approach 
those  of  WMD,  their  psychological  and  strategic  impact  could  be  enormous.5 

A  fixation  upon  the  threat  of  WMD  terrorism,  and  upon  consequence 
management  in  the  wake  of  either  natural  or  manmade  catastrophe,  has  left  America  ill- 
prepared  to  respond  quickly  and  effectively  to  a  terrorist  paramilitary  attack.  Measures 
should  be  taken  to  narrow  this  gap  in  preparedness  before  it  can  be  exploited  by  an 
intelligent,  opportunistic  enemy. 

LIKE  A  DEER  IN  THE  HEADLIGHTS 

Although  there  is  infonned  debate  over  the  attractiveness  of  WMD  to  al  Qa’ida 
and  its  jihadist  affiliates,  the  horrific  effects  of  WMD  attacks  on  the  homeland  have  led 
U.S.  homeland  security  policy,  planning,  organization,  and  operations  to  concentrate  on 
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preventing  or — should  prevention  fail — mitigating  the  consequences  of  such  attacks.6 
The  technical,  law  enforcement,  and  intelligence  challenges  of  prevention,  and  the 
massive  costs  and  organizational  requirements  of  consequence  management,  have 
dominated  the  attention,  efforts,  and  assets  of  the  interagency  community  charged  with 
homeland  security.  The  national  trauma  of  Hurricane  Katrina  in  2005  drew  official 
attention  away  from  terrorism  as  a  causative  agent,  but  reinforced  the  fixation  on 
consequence  management.  Agencies  charged  with  response  to  domestic  terrorism  are 
largely  the  same  that  have  been  mandated,  since  Katrina,  to  better  prepare  for  the 
aftennath  of  future  natural  disasters. 

Since  the  September  11,  2001  terrorist  attacks  brought  a  sense  of  urgency  to  U.S. 
counterterrorist  (CT)  planning,  a  large  body  of  official  policy  and  doctrine  has  emerged. 
While  successive  generations  of  guidance  show  increasing  sophistication  in  many  areas, 
they  are  quite  consistent  in  ignoring  modalities  of  terrorist  attack  other  than  WMD, 
isolated  IEDs,  and  suicide  terrorism — with  only  minimal  attention  spared  the  last  two 
categories.  A  selective  review  of  the  literature  will  provide  illustrative  examples. 

Homeland  Security  Presidential  Directive-5  (HSPD-5)  in  2003  provided  course 
corrections  and  guidance  for  most  subsequent  efforts  in  the  field  of  federal  emergency 
preparedness.  It  called  for  a  National  Incident  Management  System  (NIMS)  to  guide  the 
response  to  domestic  incidents  “regardless  of  cause,  size,  or  complexity.”7  It  required  the 
development  of  a  National  Response  Plan  to  “integrate  Federal  Government  domestic 
prevention,  preparedness,  response,  and  recovery  plans  into  one  all-discipline,  all-hazards 
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plan.”  Significantly,  it  directed  that  crisis  management  and  consequence  management, 
previously  treated  as  separate  yet  related  functions,  be  approached  henceforth  as  an 
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integrated  whole.9  Conflating  terrorist  attacks  with  natural  or  other  manmade  disasters, 
and  failing  to  differentiate  response  to  an  ongoing  incident  from  mitigation  of  its  after¬ 
effects,  HSPD-5  set  the  tone  for  future  policy  and  planning. 

The  National  Response  Plan  (NRP)  was  first  promulgated  in  2004,  was  revised 
in  2006  to  address  shortfalls  identified  in  the  Hurricane  Katrina  response,  and  is  soon  to 
be  replaced  by  the  National  Response  Framework  (NRF). 10  Both  documents  consistently 
profile  the  terrorist  threat  as  a  nexus  of  suicide  terrorism  and  WMD — 9/1 1  writ  large — 
leading  to  a  logical  emphasis  on  prevention  as  the  first  line  of  defense.  They  pay  scant 
attention  to  resolving  an  ongoing  crisis  of  a  non- WMD  nature,  in  the  event  that 
prevention  fails.  Both  NRP  and  NRF  are  largely  devoted  to  consequence  management, 
either  of  WMD  attacks  or  natural  disasters. 

The  lack  of  attention  paid  to  resolution  of  an  ongoing  terrorist  incident  is  also 
evident  in  the  National  Planning  Scenarios,  designed  to  provide  focus  for  exercises  and 
contingency  planning  by  all  levels  of  government.11  The  fifteen  scenarios  include  two 
natural  disasters,  an  outbreak  of  pandemic  influenza,  and  twelve  terrorist  attacks:  one 
improvised  nuclear  detonation,  one  radiological  dispersion  device,  four  biological  and 
four  chemical  attacks,  one  cyber,  one  radiological,  and  one  attack  using  multiple 
conventional  explosives.  In  several  scenarios,  terrorists  conduct  multiple  simultaneous  or 
closely  sequenced  attacks,  at  varying  distance  from  one  another.  Effects,  especially  in 
the  biological  and  radiological  attack  scenarios,  are  spread  over  time  depending  on  levels 
of  transmissibility  or  exposure,  but  attack  execution  is  essentially  instantaneous,  and  the 
scope  of  government  response  is  limited  to  consequence  management  and  criminal 


4 


19 

investigation.  Nowhere  in  the  National  Planning  Scenarios  is  there  a  requirement  for  a 
tactical  response  to  resolve  an  ongoing  situation  or  disrupt  terrorist  actions  in  progress. 

DOD  and  Department  of  Homeland  Security  (DHS)  guidance,  with  only  rare 

13 

exceptions,  describe  a  terrorist  threat  based  primarily  on  mass-casualty  WMD  attacks. 
This  fixation  upon  WMD  terrorism  combines  with  the  recurring  national  experience  of 
other  manmade  or  natural  disasters  to  focus  planning  efforts  overwhelmingly  on 
consequence  management. 

COMMAND,  CONTROL,  AND  (UN)RESPONSIVENESS 

Unity  of  command  and  clearly  defined  command  and  support  relationships,  across 
a  wide  spectrum  of  responding  agencies,  would  be  essential  in  the  event  of  a  time- 
sensitive  and  ongoing  terrorist  incident.  The  NRF  and  other  national  response  guidance 
offers  an  architecture  for  command  and  control  (C2)  that  could  well  prove  cumbersome, 
confusing,  and  unresponsive  in  such  a  crisis,  however  sensitive  it  may  be  to  political  and 
statutory  relationships,  and  however  workable  under  the  less  constrained  timelines  of 
disaster  response  or  consequence  management. 

When  terrorist  involvement  in  an  incident  is  identified,  or  when  local  law 
enforcement  capabilities  prove  inadequate,  these  agencies  are  expected  to  request 
assistance  from  the  U.S.  Department  of  Justice.  DOJ’s  Federal  Bureau  of  Investigation 
(FBI)  is  the  Lead  Federal  Agency  (LFA)  for  response  to  domestic  terrorist  incidents.  This 
delineation  of  responsibility  is,  however,  somewhat  muddied  by  the  designation  of  DHS 
as  lead  agency  for  coordination  of  incident  response  generally,  across  all  levels  of 
government.14  It  is  made  no  clearer  by  DOD’s  status  as  lead  agency  for  homeland 


5 


defense:  the  seam  separating  homeland  defense  from  homeland  security  is  not  well 
defined,  particularly  in  the  context  of  an  ongoing  attack  by  foreign-based  terrorists.15 

Planning  guidance  identifies  these  seams  and  ambiguities  as  strengths,  which  they 
might  well  be,  if  national  decision  makers  have  the  time  and  situational  awareness  to 
capitalize  on  the  flexibility  and  adaptability  of  a  vaguely  defined  system,  tailoring  it  to 
the  exigencies  of  the  moment.16  In  the  critical  early  stages  of  a  terrorist  incident,  with 
vital  national  assets  at  stake,  this  ambiguity  may  seriously  challenge  the  nation’s  ability 
to  produce  a  coordinated,  effective  response. 

Critical  real-time  intelligence,  requests  and  authorizations  for  assistance, 
deployment  orders,  and  assignment  of  command  responsibility  must  flow  through  the 
“wiring  diagrams”  of  NIMS  among  local  agencies  and  three  federal  departments  (DHS, 
DOJ,  and  DOD)  with  overlapping  responsibilities,  and  then  to  their  component  agencies, 
services,  and  commands.  It  is  perhaps  a  gross  understatement  to  suggest  that  this  may 
not  occur  smoothly  in  the  early  hours  of  a  crisis. 

A  Request  for  Assistance  (RFA)  by  military  forces,  for  instance,  can  originate 
from  a  state  governor’s  office,  or  from  a  federal  agency  on  scene.  It  will  travel  through 
federal  law  enforcement  channels  to  the  Attorney  General,  from  there  to  the  Office  of  the 
Secretary  of  Defense  for  approval,  and  then  to  U.S.  Northern  Command  (NORTHCOM), 
which  only  then  receives  operational  control  of  active  duty  forces  from  other  combatant 
commands.17  If  the  forces  allocated  for  response  include  National  Guard — which  will 
likely  be  mobilizing  simultaneously  under  state  authority — further  coordination  of  their 
status  and  chain  of  command  will  be  necessary.  There  are  ample  opportunities  in  this 
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process  for  confusion  and  delay,  which  could  have  particularly  (and  literally)  fatal 

i  o 

consequences  in  an  ongoing  terrorist  incident  of  the  type  envisioned  here. 

The  National  Incident  Management  System  promotes  the  concept  of  Unified 
Command,  a  tool  for  consensus  decision-making  that  can  help  defuse  conflict  and 
integrate  civilian  agencies  with  overlapping  responsibilities  and  jurisdictions.19  Military 
forces,  however,  do  not  operate  under  the  Unified  Command  structure  at  all,  and  each 
civilian  agency,  while  participating,  maintains  a  separate  chain  of  command  for  its  own 
forces,  so  Unified  Command  at  best  provides  only  unity  of  effort. 

Under  conditions  of  ambiguity,  overlapping  responsibilities,  compressed 
timelines,  and  cascading  consequences  that  will  prevail  in  the  event  of  an  ongoing 
terrorist  attack,  mission  success  will  require  high  levels  of  coordination,  shared 
assumptions,  and  good  will  among  a  multitude  of  agencies  unaccustomed  to  cooperation 
in  a  crisis.  Tactical  responders  will  also  require  true  unity  of  command,  but  there  is  no 
construct  in  NIMS  that  will  enable  it. 

The  NIMS  command  structure  has  proven  useful,  or  at  least  usable,  in  the 
consequence  management  scenarios  for  which  it  was  primarily  designed.  When  rapid, 
forceful,  coordinated  tactical  response  is  required  to  resolve  an  ongoing  terrorist  action, 
convoluted  routing  of  requests  for  assistance,  parallel  chains  of  command,  and  the 
consensus  decision-making  of  Unified  Command  will  likely  fall  short  of  the  need. 

A  PAUCITY  OF  MEANS 

One  lesson  starkly  evident  in  the  aftermath  of  Beslan  is  that  tactical  response  to 
such  an  incident  requires  discipline,  proficiency,  and  precision.  To  deny  an  adversary 
time  to  consolidate  his  position,  cause  further  damage  or  loss  of  life,  or  exploit  the 
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propaganda  value  of  his  action,  the  response  must  also  be  swift  -  measured  in  hours,  not 
days.  Rapid  deployment  of  tactical  forces  capable  of  resolving  the  situation  is  therefore 
vital.20 

Local  law  enforcement  agencies  (LLEA)  would  respond  quickly,  but  in  most 
cases  lack  the  ability  to  defeat  numerous,  heavily  armed,  well-prepared  adversaries  like 
those  that  attacked  Beslan’s  School  No.  1  in  2004.“  Hostage  rescue  or  asset  recovery  on 
the  scale  envisioned  by  this  scenario  is  beyond  the  capability  of  most  LLEA  SWAT 
(Special  Weapons  and  Tactics)  teams.  “  Typical  local  and  state  agencies  field  teams 
composed  of  patrol  officers  who  receive  additional  specialized  training  and  equipment, 
but  train  and  operate  as  a  team  only  on  an  occasional  basis,  and  require  time  to  assemble 
and  orient  to  a  crisis  situation.  Only  the  largest  metropolitan  jurisdictions  possess  full¬ 
time  SWAT  teams  which  can  respond  quickly  and  in  strength  to  local  incidents  with  a 
high  level  of  cohesion  and  tactical  proficiency.  Whether  full-time  or  part-time,  LLEA 
SWAT  teams  quite  understandably  tend  to  focus  their  limited  resources  and  training  time 
on  the  scenarios  they  most  frequently  confront,  such  as  high  risk  warrant  service,  active 
shooters,  and  barricaded  suspects;  tactics  and  techniques  suitable  for  these  situations  are 
often  dangerously  incompatible  with  the  requirements  of  combat  against  multiple, 
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dedicated,  well-prepared,  hostage-holding  terrorists.- 

Collaborative  efforts  by  teams  from  different  jurisdictions  are  theoretically 
possible,  but  the  unfortunate  reality  is  that  in  the  time  and  resource-constrained  world  of 
law  enforcement,  such  actions  are  seldom  trained  or  exercised.  The  likelihood  of 
cooperation  among  local  agencies  resolving  a  situation  of  this  magnitude  is  small,  thanks 
to  dissimilar  tactics,  techniques,  and  procedures  (TTP),  incompatible  communications, 
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and  a  general  lack  of  experience  in  planning  and  conducting  dynamic,  multi-agency 
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tactical  operations  on  this  scale. 

The  FBI  represents  the  next  echelon  of  response.  It  is  unlikely,  however,  that  the 
Bureau  could  quickly  field  a  tactical  capability  commensurate  with  its  authority.  Its  field 
offices,  in  56  U.S.  cities,  can  mobilize  SWAT  teams  composed  of  Special  Agents  who 
volunteer  for  this  ancillary  duty  and  receive  appropriate  specialized  training.  Team  size 
varies,  but  at  the  larger  field  offices  may  include  as  many  as  twenty  agents,  including 
sniper  teams,  breachers,  and  assaulters.  As  with  most  LLEA  SWAT  teams,  their 
personnel  have  other  primary  duties,  and  are  seldom  afforded  the  opportunity  to  train 
together  as  a  tactical  team  more  than  a  few  days  a  month.  A  larger  regional  SWAT  team 
can  be  assembled  from  these  field  office  elements,  but  assembly  alone  could  require  days, 
and  a  composite  regional  team  is  even  less  likely  to  be  capable  of  fully  integrated  tactical 
operations  without  additional  time  for  training  and  rehearsal.  Although  they  have  proven 
adequate  for  the  wide  range  of  federal  law  enforcement  contingencies  for  which  they 
were  created,  FBI  SWAT  teams  may  offer  only  a  limited  enhancement  of  local 
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capabilities  in  time-sensitive  terrorism  scenarios. 

The  FBI’s  Hostage  Rescue  Team  (HRT),  the  tactical  component  of  its  Critical 
Incident  Response  Group,  is  a  large,  full-time  tactical  team:  a  highly  capable  national 
asset.  There  may,  however,  be  critical  limitations  on  its  ability  to  resolve  the  sort  of  CT 
scenario  envisioned  here.  Without  specific  prior  warning  of  an  imminent  attack,  it  would 
not  be  deployed  forward  from  its  base  in  Virginia,  and  could  therefore  require  many 
hours  of  air  and  surface  travel  to  be  mission  ready  at  an  incident  site,  particularly  one  in 
the  central  or  western  United  States.  The  HRT  lacks  sufficient  strength,  as  well  as 
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redundant  command,  planning,  support,  and  transportation  capabilities,  for  response  to 
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several  simultaneous  or  closely  sequenced  attacks  in  dispersed  locations. 

Other  federal  agencies  possess  tactical  teams  with  varying  degrees  of  proficiency 
and  availability.  Designated  military  Quick  Response  Forces  (QRF),  as  well  as  the 
tactical  teams  of  installation  security  forces,  are  capable  of  providing  support  to  civil 
authorities,  given  either  completion  of  the  RFA  process  described  earlier,  or  a  local 
commander’s  determination  that  immediate  response,  on  his  own  authority,  is  necessary. 
Few  of  these  forces,  however,  are  trained  or  equipped  for  CT  operations  even  to  the  level 
of  FBI  or  LLEA  SWAT  teams,  and  they  would  introduce  additional  interoperability  and 
chain  of  command  issues  to  offset  any  incremental  advantage  they  offer,  beyond 
assistance  in  perimeter  control  and  other  supporting  roles. 

DOD  special  operations  forces  (SOF)  that  have  a  particular  counterterrorism 
focus  possess  a  robust  capability  for  tactical  response,  but  their  utility  is  limited  by  time, 
space,  and  force  considerations  in  much  the  same  way  as  the  FBI  HRT.  The  demands  of 
wartime  operations  overseas  further  limit  the  readiness  of  these  military  assets.  Forces 
tasked  with  domestic  civil  support  in  terrorism  contingencies  are  unlikely  to  be  fully 
dedicated  to  training  and  preparation  for  that  mission,  carrying  it  instead  as  an  ancillary 
responsibility  during  periods  of  reconstitution,  while  rotated  stateside  out  of  combat  zone 
deployments. 

The  Posse  Comitatus  Act  or  PCA  (Title  18,  U.S.  Code,  Section  1385)  limits  direct 
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involvement  of  most  Title  10  (active  duty)  military  forces  in  domestic  law  enforcement. 
The  extent  to  which  it  restricts  the  utility  of  military  assets  in  domestic  CT  roles  is  by  no 
means  resolved.  As  noted  earlier,  the  seam  between  homeland  security,  where  civilian 
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agencies  lead  and  counterterrorism  is  seen  as  a  law  enforcement  function,  and  homeland 
defense  missions  where  DOD  leads  and  possesses  considerable  freedom  of  action,  is 
imprecise  and  largely  untested  by  real  world  applications.  Some  DOD  guidance  claims 
that  statutory  exceptions  to  PCA,  or  direct  Presidential  authorization,  will  result  in 
minimal  restriction  on  its  forces’  freedom  to  assist  law  enforcement  even  during  civil 
support  missions.  Other  guidance  is  less  sanguine,  and  the  boundaries  and  authorities  are 
not  portrayed  consistently.28 

Academic  studies,  as  well  as  common  perceptions  among  civil  authorities  and 
even  in  the  DOD  community,  reflect  the  same  ambivalence  displayed  in  DOD 
guidance.'  Readiness  of  local  authorities  or  lead  federal  agencies  to  request  DOD 
tactical  assets,  to  integrate  them  rapidly  and  effectively,  and  to  entrust  them  with  local 
command  of  tactical  operations  would  require  a  remarkable  and  apparently  not  universal 
degree  of  confidence  in  the  legal  basis  for  their  participation. 

Legal  issues  aside,  military  CT  teams  in  a  domestic  role  would  find  themselves  in 
an  operating  environment  very  unlike  those  that  pertain  to  most  overseas  warfighting 
missions.  They  would  be  called  upon  to  work  in  close  cooperation,  on  compressed 
timelines,  with  civilian  agencies  that  do  not  share  their  doctrine,  equipment,  TTP,  or  C2 
structure  and  methods. 

Conflicts  over  jurisdiction,  responsibility,  and  capacity  among  responding  local 
agencies,  the  FBI,  and  military  assets  are  a  form  of  friction  that  must  be  expected  - 
particularly  in  the  absence  of  frequent  joint  and  interagency  tactical  response  exercises 
involving  all  critical  stakeholders.  These  stakeholders  include  LLEA  nationwide,  all  FBI 
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field  offices,  the  National  Guard  of  every  state,  and  the  full  range  of  Title  10  (active  duty 

TO 

military)  forces  discussed  earlier. 

In  summary,  tactical  teams  that  could  respond  effectively  to  a  terrorist 
paramilitary  threat  within  the  United  States  are  limited  in  number,  size,  interoperability, 
and  the  speed  with  which  they  could  respond  to  many  incident  sites.  They  would  be 
hard-pressed  to  respond  to  multiple  simultaneous  or  closely  sequenced  contingencies — a 
limitation  that  could  be  exploited  by  an  adversary’s  use  of  diversions  or  secondary  efforts. 
Their  ability  to  coordinate  their  actions  with  supporting  agencies  in  a  hostage  rescue  or 
asset  recovery  mission  against  significant  opposition,  in  a  domestic  environment,  remains 
largely  untested. 


RECOMMENDATIONS 

The  foregoing  discussion  has  identified  three  significant  gaps  in  the  nation’s 
preparedness  to  meet  a  paramilitary  terrorist  attack  on  U.S.  soil:  inattention  to  the  threat 
in  scenarios,  exercises,  and  guidance  that  drive  training  and  preparation  at  all  levels  of 
government;  limited  availability  and  slow  deployment  times  of  capable  CT  forces;  and 
the  unwieldiness  of  the  command  and  control  structure  which  would  authorize  and 
coordinate  their  employment.  In  the  context  of  an  ongoing  competition  for  time, 
resources,  and  attention — that  is,  within  the  art  of  the  possible— several  recommendations 
are  offered. 

Great  returns  can  be  achieved  from  modest  investments,  by  reorienting  the 
considerable  efforts  of  the  homeland  security  community  to  an  approach  more  inclusive 
of  the  full  range  of  terrorist  threats.  Even  without  major  force  structure,  funding,  or  top- 
down  C2  and  doctrinal  changes  (although  all  of  these  may  ultimately  be  necessary),  the 
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gaps  in  preparedness  may  be  narrowed  considerably.  Simply  widening  the  focus  of 
exercises  to  include  paramilitary  terrorist  attack  scenarios  would  highlight  areas  requiring 
policy  attention,  identify  work-arounds,  and  prepare  key  decision  makers  for  their  roles  in 
this  type  of  situation.  Proper  critiques  of  such  exercises,  and  wide,  effective 
dissemination  of  lessons  learned  to  agencies  at  all  levels  from  local  police  to  DHS,  DOD, 
and  DOJ  would  be  critical,  and  is  the  most  often  neglected  part  of  the  training  process. 
After-action  reviews  must  be  brutally  honest,  fully  documented,  and  devoid  of  blame. 
Participants  must  set  aside  egos  as  well  as  personal  and  interagency  rivalries  and 
welcome  the  use  of  their  failures,  along  with  their  successes,  to  educate  their  counterparts 
nationwide. 

Three  more  components  of  a  likely  solution  emerge  from  the  preceding  analysis. 
Implementation  will  require  careful  consideration  of  where  the  domestic  counterterrorist 
mission  should  reside,  but  should  be  shaped  by  the  following  assumptions: 

•  Dedicated,  full-time  CT  units  can  best  provide  the  key  tactical  competencies 
required  to  resolve  an  ongoing  incident. 

•  Streamlined  C2,  cutting  the  Gordian  Knot  of  the  NRF  authorization  process, 
could  promise  the  rapid  commitment  of  CT  units  in  a  crisis. 

•  Regional  basing  could  drastically  reduce  deployment  time  to  all  parts  of  the 
country,  compared  to  the  current  reliance  on  centralized  assets  located  on  the 
coasts,  while  also  promoting  area  familiarity  and  interoperability  with  local, 
state,  and  other  federal  agencies  in  each  region. 
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A  Military  Solution 


Studies  of  the  DOD  role  in  homeland  security,  much  like  the  official  literature, 
focus  primarily  on  support  to  civil  authorities  in  natural  or  manmade  disasters  and  WMD 
terrorism  scenarios.  Certain  of  their  recommendations  could  nonetheless  contribute  to 
improving  counterterrorist  capabilities.  These  include  the  constitution  of  standing, 
regionally  based  response  units  with  a  primary  civil  support  mission,  each  based  on  an 
Army  Brigade  Combat  Team  or  a  Marine  Air  Ground  Task  Force,  substantially 
augmented  with  specialties  such  as  Military  Police,  Engineers,  and  Civil  Affairs  from 
both  active  and  reserve  components.  To  address  the  deficiency  in  CT  capabilities  posed 
by  this  analysis,  they  might  also  include  dedicated  CT  teams  drawn  from  U.S.  Special 
Operations  Command  (USSOCOM).  One  study  suggests  a  total  of  three  of  these 
reinforced  brigades.31  Another  more  ambitiously  proposes  one  for  each  of  the  ten  Federal 
Emergency  Management  Agency  (FEMA)  regions. 

Both  studies  conceive  of  these  response  forces  as  full  time,  federally  funded  Title 
10  forces,  assigned  to  USNORTHCOM.  Under  the  current  system,  USNORTHCOM 
only  receives  operational  control  over  active  and  reserve  component  formations  during  a 
crisis,  in  response  to  a  Request  for  Assistance.  While  active  duty  forces  assigned 
pennanently  to  USNORTHCOM  could  presumably  respond  more  quickly  once 
committed,  processing  RFAs  through  civilian  interagency  channels  could  still  delay  their 
commitment,  despite  their  relative  proximity  to  an  incident  site  and  their  simplified  chain 
of  command. 

Issues  relating  to  Title  10  versus  state  active  duty  or  Title  32  status  for  National 
Guard  components  of  the  proposed  regional  response  forces  are  not  particularly  relevant 
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for  their  counterterrorist  components.  Maintenance  of  proficiency  in  complex  perishable 
skills,  and  the  requirement  for  swift  deployment  in  a  crisis,  both  argue  for  full-time,  Title 
10  active  duty  status  for  the  CT  teams.  For  Title  10  forces,  however,  the  ambiguity 
discussed  earlier  concerning  legal  authority — is  the  mission  homeland  defense  or  support 
to  civilian  law  enforcement — would  still  beg  resolution. 

The  advantages  in  response  time  gained  from  regional  basing  would  be  somewhat 
offset  by  the  difficulties  of  ensuring  consistent,  high  quality  training  and  support  for 
dispersed  SOF  elements  no  longer  centrally  based  or  assigned  to  USSOCOM.  Regional 
reproduction  of  the  training  facilities  and  infrastructure  of  USSOCOM  is  unlikely, 
suggesting  either  reduced  opportunities  for  training  or  regular  travel  out  of  region  to 
training  sites.  Team  size  would  have  to  be  large  enough  to  maintain  a  capable, 
responsive  element  on  call  for  crisis  deployments,  while  accommodating  training  and 
administrative  requirements.  These  would  not  be  small  teams. 

Reliance  on  DOD  for  improved  domestic  CT  capabilities  would  also  require 
funding  for  further  expansion  of  SOF,  in  order  to  avoid  a  negative  impact  on  war  fighting 
capabilities  and  commitments;  fencing  these  units  from  diversion  to  other  missions;  time 
to  identify  and  assign  cadre,  and  then  to  recruit,  train,  and  attain  operational  capability  for 
new  CT  teams;  and  finding  or  improving  appropriate  basing  facilities  with  ready  access 
to  air  and  ground  transportation  covering  the  assigned  region.  These  requirements  would 
also  pertain  more  broadly  to  the  larger  project  of  standing  up  brigade-size  regional 
response  forces,  and  could  introduce  significant  delays  in  implementation. 
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A  More  Civil  Approach 


A  better  solution  to  this  problem  may  be  found  in  an  expansion  and  redeployment 
of  existing  FBI  counterterrorist  capabilities.  The  HRT  offers  a  model  for  an  expanded, 
regionally  based  Federal  CT  force.  Depending  on  how  regional  boundaries  were  drawn, 
two  or  three  additional  teams  of  similar  strength  and  organization  would  constitute  a 
significant  improvement  in  capabilities  and  responsiveness,  for  a  relatively  modest 
investment  in  200-300  additional  special  agents,  plus  administrative  and  support  echelons 
as  required.  New  teams  could  be  built  on  cadre  recruited  from  Field  Office  SWAT  teams 
and  the  existing  HRT,  and  augmented  as  necessary  from  those  sources  until  additional 
recruitment  and  training  filled  their  ranks. 

This  approach  would  provide  a  simplified  C2  structure,  unambiguous  jurisdiction 
and  legal  authority,  and  a  clear  orientation  to  the  domestic  operating  environment  in 
doctrine,  tactics,  and  training.  These  teams  might  contribute  to  the  non-CT  missions  of 
the  Bureau’s  current  SWAT  and  HRT  teams  so  long  as  readiness  for  CT  contingencies 
remained  their  first  priority.  They  could  relieve  DOD  special  operations  forces  of 
responsibility  for  domestic  CT  missions  in  all  but  the  gravest  circumstances. 

Such  an  expansion  of  agent  end-strength,  and  the  necessary  support  staff  and 
infrastructure,  would  require  a  significant  increase  in  FBI  budget,  but  is  not 
disproportionate  in  the  context  of  other  ongoing  increases  in  federal  law  enforcement 
manning  and  capability,  for  instance  in  the  effort  to  improve  border  protection.  Shifting 
current  efforts  or  personnel  without  expanding  end-strength,  beyond  the  use  of  existing 
technical  expertise  and  tactical  leadership  for  cadre,  could  only  damage  the  Bureau’s 
ability  to  conduct  other  vital  tasks.  Rather  than  a  diversion  of  resources  from  other 
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efforts,  this  should  be  undertaken  as  a  necessary  increase  in  the  nation’s  investment  in 
security  from  terrorist  threats. 


CONCLUSION 

In  the  gap  between  prevention  (where  we  stake  many  of  our  hopes,  and  count 

many  successes)  and  consequence  management  (where  we  currently  devote  a 

preponderance  of  our  resources)  lies  the  risk  of  a  technically  unsophisticated 

paramilitary  attack  on  assets  we  are  not  prepared  to  lose,  and  which  might  offer 

tremendous  leverage  to  a  ruthless  and  dedicated  adversary.  It  may  be  time  to  heed  our 

own  counsel,  as  stated  in  JP  3-07.2,  Antiterrorism : 

Terrorists  choose  their  targets  deliberately  based  on  the  weaknesses  they  observe 
in  our  defenses  and  in  our  preparations.  They  can  balance  the  difficulty  in 
successfully  executing  a  particular  attack  against  the  magnitude  of  loss  it  might 
cause.  They  can  monitor  our  media  and  listen  to  our  policymakers  as  our  Nation 
discusses  how  to  protect  itself  -  and  adjust  their  plans  accordingly.  Where  we 
insulate  ourselves  from  one  form  of  attack,  they  can  shift  and  focus  on  another 
exposed  vulnerability.  We  must  defend  ourselves  against  a  wide  range  of  means 

•5-5 

and  methods  of  attack. 

Political,  legal,  and  budgetary  considerations  will  continue  to  bound  the  art  of  the 
possible;  there  can  be  no  perfect  or  impenetrable  defense.  Prioritization  of  threats  to 
homeland  security  will  remain  a  calculus  of  probability  and  consequence;  but  the  threat 
we  neglect  may  well  prove  most  appealing  to  the  adversary. 
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17  JP  3-28  Civil  Support,  1I-3-II-7,  and  USNORTHCOM,  CONPLAN  2501-05,  Annex  A  (not  paginated). 

18  Military  commanders  are  authorized  to  respond  without  prior  authorization  through  the  RFA  process  in 
time-sensitive  situations,  although  it  appears  unlikely  that  specialized  counterterrorist  forces  hundreds  of 
miles  from  the  incident  scene  would  deploy  on  this  basis.  JP  3-28  Civil  Support,  II-7. 

19  Federal  Emergency  Management  Agency,  National  Incident  Management  System,  47-50. 

20  Assorted  Russian  Federal  Security  Service  and  military  units  arrived  at  Beslan  throughout  the  28-hour 
period  between  the  initial  takeover  and  the  poorly  conducted  assault  which  resulted  in  hundreds  of  dead 
hostages.  Armed  local  militia  proved  even  more  resistant  to  command  authority,  and  less  attentive  to  rules 
of  engagement,  than  the  security  forces.  During  this  time,  inconsistent  attempts  to  negotiate  with  the 
terrorists,  and  the  lack  of  rest  or  sustenance  degraded  terrorist  morale  and  discipline.  Hostages  were  abused 
and  killed  throughout  the  siege.  Terrorist  preparations  to  resist  assault  were  continuous  from  the  time  of 
the  takeover.  There  is  no  indication  that  the  passage  of  time  worked  to  the  advantage  of  the  authorities  in 
any  fashion.  Dunlop,  2002  Dubrovka  and  2004  Beslan  Hostage  Crises,  51-82.  If  the  seized  assets  were 
instead  nuclear,  radiological,  or  other  CBRNE  materials,  they  would  require  recovery  at  the  earliest 
possible  moment  to  prevent  catastrophic  exploitat  ion  by  the  terrorists. 

21  Thirty-two  terrorist  bodies  were  recovered  on  the  scene,  but  eyewitness  reports  and  professional  critiques 
suggest  that  the  total  terrorist  force  may  have  numbered  between  50  and  70— with  the  balance  escaping 
during  the  poorly  coordinated  assault.  Dunlop,  2002  Dubrovka  and  2004  Beslan  Hostage  Crises,  41-42. 

22  “SWAT”  is  employed  for  convenience  here  to  describe  a  variety  of  designations,  e.g.  Special  Response 
Team,  Special  Operations  Team,  or  Emergency  Response  Team. 

23  Giduck,  Terror  at  Beslan,  289-316,  offers  a  detailed  analysis  of  the  inadequacies  of  routine  domestic 
SWAT  practices  when  confronting  a  Beslan-like  threat.  Author’s  experience  as  a  trainer  in  the  Special 
Response  Force  Program  of  the  U.S.  Department  of  Energy  confirms  the  importance  of  a  counterterrorist 
focus  for  responders  to  such  incidents. 

24  Author’s  observation  of  Operation  Urgent  Response,  sponsored  by  the  Transportation  Security 
Administration  in  northwest  Arkansas  in  2004.  In  this  exercise  portraying  a  terrorist  takeover  of  a 
passenger  train,  SWAT  teams  from  neighboring  jurisdictions  demonstrated  poor  interoperability,  and 
Unified  Command  in  the  ICS  command  post  did  not  result  in  effective  assault  planning  in  the  limited  time 
available.  The  conclusion  is  further  reinforced  by  the  author’s  experience  planning  and  conducting 
numerous  training  exercises  2001-2005  involving  Department  of  Energy  tactical  teams  and  interagency 
counterparts  nationwide. 

25  Federal  Bureau  of  Investigation,  El  Paso  Division,  “SWAT  and  ERT,”  supported  by  Special  Agent  David 
J.  Raymond,  telephone  call  with  author,  16  October  2007,  and  by  author’s  observations  based  on  joint 
training  and  interaction  with  FBI  regional  SWAT  team  members  2001-2004. 

26  Federal  Bureau  of  Investigation,  “Investigative  Programs,  Critical  Incident  Response  Group:  Tactical 
Support  Branch,”  further  explicated  by  Special  Agent  David  J.  Raymond,  telephone  call  with  author,  16 
October  2007. 

27  U.S.  Navy  and  Marine  Corps  forces  are  restricted  only  by  customary  DOD  policy,  not  by  the  letter  of  the 
law. 

28  For  instance,  U.S.  Department  of  Defense,  Homeland  Defense  and  Civil  Support  Joint  Operating 
Concept,  40,  and  JP  3-28  Civil  Support,  F-2  assert  broad  authority  for  Title  10  forces  under  various 
statutory  exceptions  or  direct  Presidential  authorization;  but  JP  3-28, 1-9  cites  “legal  restrictions  which 
generally  preclude  DOD  from  participating  in  CrM  [crisis  management]  law  enforcement  investigations 
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and  operations.”  USNORTHCOM,  Defense  Support  of  Civil  Authorities,  Paragraph  lg(3)  also  provides  a 
narrower  interpretation  of  the  circumstances  permitting  military  involvement  in  law  enforcement  during 
civil  support  operations. 

29  Stevens,  U.S.  Armed  Forces  and  Homeland  Defense:  The  Legal  Framework,  3  and  22-27,  argues  for 
broad  Title  10  authority,  while  a  more  restrictive  view  is  expressed  in  Brake,  Terrorism  and  the  Military’s 
Role  in  Domestic  Crisis  Management,  1 1 . 

30  Author’s  observations  of  Department  of  Energy  Joint  Training  Exercises  1994-present  are  illustrative  of 
these  frictions.  In  one  case  (Exercise  Digit  Pace  II,  1997)  conflicting  assertions  of  authority  by  a  DOE 
tactical  commander  and  State  Police  Incident  Commander  on-scene  resulted  in  the  passage  of  several  hours 
before  the  two  first  met  to  begin  discussions  regarding  unified  command.  On  another  occasion,  an  FBI 
Special  Agent  in  Charge  (SAC)  arrived  at  an  incident  scene  and  asserted  immediate  LFA  command 
authority  in  the  midst  of  ongoing  tactical  operations  despite  the  absence  of  Bureau  resources, 
communications  capability,  or  situational  awareness.  Every  such  occasion  generates  valuable  lessons 
learned  and  should  contribute  to  a  steep  learning  curve  for  all  involved  -  but  are  these  experiences  frequent 
and  inclusive  enough,  or  disseminated  widely  enough,  to  have  broad  utility? 

3 1  Davis,  et.al..  Army  Forces  for  Homeland  Security’,  suggests  integration  of  these  three  brigades  with  the 
forthcoming  DHS  regional  structure.  A  counterterrorist  team  is  part  of  the  organization  proposed  by  this 
study. 

32 

Johnson,  “Active  Component  Rapid  Response  Force,”  envisions  ten  Regional  Response  Units,  a  number 
difficult  to  provide  in  an  era  of  limited  forces  and  heavy  overseas  commitments.  Fencing  ten  brigades  out 
of  the  overseas  deployment  cycle  may  be  impossible  for  at  least  the  near  future.  However,  the  alternative 
of  assigning  the  civil  support  mission  to  units  reconstituting  from  a  deployment  or  preparing  for  their  next 
one  would  not  meet  the  need  for  dedicated  forces  with  focused  training  and  planning  for  their  domestic 
responsibility.  A  more  modest  number  of  dedicated  response  units,  based  upon  broader  regional 
boundaries  than  FEMA’s,  might  be  advisable. 

33  JP  3-07.2  Antiterrorism,  11-08. 
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